# -*- coding: utf-8 -*- #
# Copyright 2025 Google LLC. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# NOTE: This file is autogenerated and should not be edited by hand.
# AUTOGEN_CLI_VERSION: HEAD
- release_tracks:
  - ALPHA
  auto_generated: true
  hidden: true
  help_text:
    brief: Create PrincipalAccessBoundaryPolicy instance.
    description: |
      Create PrincipalAccessBoundaryPolicy instance.
    examples: |-
      To create a policy instance called `my-policy`, run:

      $ {command} my-policy --organization=123 --location=global
  arguments:
    params:
    - help_text: |-
        Identifier. The resource name of the principal access boundary policy.

        The following format is supported:
        `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`
      is_positional: true
      is_primary_resource: true
      request_id_field: principalAccessBoundaryPolicyId
      resource_spec: !REF googlecloudsdk.command_lib.iam.v3alpha_resources:organizations_locations_principal_access_boundary_policies
      required: true
    - arg_name: etag
      api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.etag
      required: false
      repeated: false
      help_text: |-
        The etag for the principal access boundary.
        If this is provided on update, it must match the server's etag.
    - arg_name: display-name
      api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.displayName
      required: false
      repeated: false
      help_text: |-
        The description of the principal access boundary policy. Must be less than
        or equal to 63 characters.
    - arg_name: annotations
      api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.annotations
      required: false
      repeated: true
      help_text: |-
        User defined annotations. See https://google.aip.dev/148#annotations for
        more details such as format and size limitations
      spec:
      - api_field: key
      - api_field: value
    - group:
        api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.details
        required: false
        help_text: |-
          Principal access boundary policy details
        params:
        - arg_name: details-rules
          api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.details.rules
          required: true
          repeated: true
          help_text: |-
            A list of principal access boundary policy rules. The number of rules in a
            policy is limited to 500.
          spec:
          - api_field: description
            help_text: |-
              The description of the principal access boundary policy rule. Must be less
              than or equal to 256 characters.
          - api_field: resources
            help_text: |-
              A list of Resource Manager resources. If a resource is listed in the rule,
              then the rule applies for that resource and its descendants. The number of
              resources in a policy is limited to 500 across all rules in the policy.

              The following resource types are supported:

              * Organizations, such as
              `//cloudresourcemanager.googleapis.com/organizations/123`.
              * Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`.
              * Projects, such as `//cloudresourcemanager.googleapis.com/projects/123`
                or `//cloudresourcemanager.googleapis.com/projects/my-project-id`.
          - api_field: effect
            help_text: |-
              The access relationship of principals to the resources in this rule.
        - arg_name: details-enforcement-version
          api_field: googleIamV3alphaPrincipalAccessBoundaryPolicy.details.enforcementVersion
          required: false
          repeated: false
          help_text: |-
            The version number (for example, `1` or `latest`) that indicates which
            permissions are able to be blocked by the policy. If empty, the PAB policy
            version will be set to the most recent version number at the time of the
            policy's creation.
  request:
    api_version: v3alpha
    collection:
    - iam.organizations.locations.principalAccessBoundaryPolicies
  async:
    collection:
    - iam.organizations.locations.operations
